# NovaCPX dedicated panel web server
# Runs as novacpx-web.service — independent of system Apache/Nginx

user www-data;
pid        /run/novacpx-nginx.pid;
error_log  /var/log/novacpx/nginx-error.log;

events { worker_connections 64; }

http {
    include /etc/nginx/mime.types;
    default_type  application/octet-stream;
    access_log    /var/log/novacpx/nginx-access.log;
    sendfile      on;
    gzip          on;

    # Large uploads via the admin File Manager (e.g. ISOs, installers) can be multi-GB.
    client_max_body_size 20g;

    # ── Admin Panel (8882) ─────────────────────────────────────────────────────
    server {
        listen 8882 ssl;
        server_name _;
        root /srv/novacpx/public/admin;
        index index.php index.html;
        ssl_certificate     /etc/novacpx/ssl/novacpx.crt;
        ssl_certificate_key /etc/novacpx/ssl/novacpx.key;
        ssl_protocols       TLSv1.2 TLSv1.3;

        location / { try_files $uri $uri/ /index.php?$query_string; }
        location /assets { root /srv/novacpx/public; }
        location /lib     { deny all; }

        location ~ \.php$ {
            fastcgi_pass  unix:/run/php/php8.3-fpm.sock;
            fastcgi_index index.php;
            include       /etc/nginx/fastcgi_params;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_param SERVER_PORT     8882;
            fastcgi_read_timeout 300;
        }

        location /api/ {
            fastcgi_pass  unix:/run/php/php8.3-fpm.sock;
            fastcgi_index index.php;
            include       /etc/nginx/fastcgi_params;
            fastcgi_param SCRIPT_FILENAME /srv/novacpx/public/api/index.php;
            fastcgi_param SERVER_PORT     8882;
            fastcgi_read_timeout 1800;
            fastcgi_send_timeout 1800;
            client_body_timeout  1800;
            send_timeout         1800;
            # Stream the request body straight to PHP-FPM instead of nginx buffering
            # the whole thing to a temp file first and then reading it back — cuts a
            # full extra disk read+write pass for large uploads (ISOs, installers).
            fastcgi_request_buffering off;
            fastcgi_param PHP_VALUE "upload_max_filesize=20G
post_max_size=20G
max_execution_time=1800
max_input_time=1800";
        }
    }

    # ── Reseller Panel (8881) ──────────────────────────────────────────────────
    server {
        listen 8881 ssl;
        server_name _;
        root /srv/novacpx/public/reseller;
        index index.php index.html;
        ssl_certificate     /etc/novacpx/ssl/novacpx.crt;
        ssl_certificate_key /etc/novacpx/ssl/novacpx.key;
        ssl_protocols       TLSv1.2 TLSv1.3;

        location / { try_files $uri $uri/ /index.php?$query_string; }
        location /assets { root /srv/novacpx/public; }
        location /lib     { deny all; }

        location ~ \.php$ {
            fastcgi_pass  unix:/run/php/php8.3-fpm.sock;
            fastcgi_index index.php;
            include       /etc/nginx/fastcgi_params;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_param SERVER_PORT     8881;
            fastcgi_read_timeout 300;
        }

        location /api/ {
            fastcgi_pass  unix:/run/php/php8.3-fpm.sock;
            include       /etc/nginx/fastcgi_params;
            fastcgi_param SCRIPT_FILENAME /srv/novacpx/public/api/index.php;
            fastcgi_param SERVER_PORT     8881;
            fastcgi_read_timeout 300;
        }
    }

    # ── User Panel (8880) ──────────────────────────────────────────────────────
    server {
        listen 8880 ssl;
        server_name _;
        root /srv/novacpx/public/user;
        index index.php index.html;
        ssl_certificate     /etc/novacpx/ssl/novacpx.crt;
        ssl_certificate_key /etc/novacpx/ssl/novacpx.key;
        ssl_protocols       TLSv1.2 TLSv1.3;

        location / { try_files $uri $uri/ /index.php?$query_string; }
        location /assets { root /srv/novacpx/public; }
        location /lib     { deny all; }

        location ~ \.php$ {
            fastcgi_pass  unix:/run/php/php8.3-fpm.sock;
            fastcgi_index index.php;
            include       /etc/nginx/fastcgi_params;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_param SERVER_PORT     8880;
            fastcgi_read_timeout 300;
        }

        location /api/ {
            fastcgi_pass  unix:/run/php/php8.3-fpm.sock;
            include       /etc/nginx/fastcgi_params;
            fastcgi_param SCRIPT_FILENAME /srv/novacpx/public/api/index.php;
            fastcgi_param SERVER_PORT     8880;
            fastcgi_read_timeout 300;
        }
    }

    # ── Webmail (8883) ─────────────────────────────────────────────────────────
    server {
        listen 8883 ssl;
        server_name _;
        root /usr/share/roundcube;
        index index.php;
        ssl_certificate     /etc/novacpx/ssl/novacpx.crt;
        ssl_certificate_key /etc/novacpx/ssl/novacpx.key;
        ssl_protocols       TLSv1.2 TLSv1.3;

        location / { try_files $uri $uri/ /index.php; }
        location ~ \.php$ {
            fastcgi_pass  unix:/run/php/php8.3-fpm.sock;
            include       /etc/nginx/fastcgi_params;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_read_timeout 120;
        }
        location ~ /\.(ht|git) { deny all; }
    }
}